permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/admin/attention_items.rb

@@ -6,8 +6,6 @@ module PermissionForge
     # a read-only query; actions (extend, keep, clean up, acknowledge) live in
     # the controllers.
     class AttentionItems
-      ENDING_DAYS = 7
-
       # `field` — the field row, when there is one, switched on or off.
       # `implicit_grant` — no active field row, and the field is readable and
       # editable anyway because the model declares it as an extra (virtual) field.
@@ -18,6 +16,16 @@ module PermissionForge
         def turned_off? = !field.nil? && !field.is_active
         def implicit_grant? = implicit_grant == true
         def name = field&.name || column
+
+        # Masking, acknowledging or adding the field changes what the locked
+        # field, Resource or Permission Set holds: refused (EditableLock), so
+        # Home offers neither "Fix" nor "This is intended" for it.
+        def locked? = !EditableLock.locked_record(field, resource).nil?
+
+        # Home offers "This is intended" for it: a field that is shown unmasked
+        # and can be changed (acknowledging needs the column, see
+        # .acknowledgement_supported?).
+        def acknowledgeable? = !unconfigured? && !locked?
       end
 
       TidyFinding = Struct.new(:permission_set, :kind, :people_count, keyword_init: true) do
@@ -42,22 +50,75 @@ module PermissionForge
         end
       end
 
-      def self.acknowledgement_supported?
-        PermissionForge::ResourceField.column_names.include?('sensitive_acknowledged_at')
-      rescue StandardError
-        false
+      # An active rule in effect that matches nothing because it names a
+      # column or an association that is not there (Operators::RuleProblem):
+      # everyone it applies to is denied every record of its resource.
+      BrokenRuleFinding = Struct.new(:rule, :problem, :people_count, keyword_init: true) do
+        def resource = rule.resource
+        def permission_set = rule.resource.permission_set
+
+        # The rule, its Resource or its Permission Set is locked: Home opens
+        # the Rules tab instead of the rule's edit page (which refuses it).
+        def locked? = !EditableLock.locked_record(rule).nil?
+      end
+
+      # A field row in effect masked with a strategy this app does not know.
+      MaskStrategyFinding = Struct.new(:field, :people_count, keyword_init: true) do
+        def resource = field.resource
+        def permission_set = field.resource.permission_set
       end
 
-      def initialize(configuration: PermissionForge.configuration, catalog: ModelCatalog.new,
+      # A set whose activation condition nobody can judge: a muting one
+      # applies to every request, a granting one never passes.
+      ConditionsFinding = Struct.new(:permission_set, :people_count, keyword_init: true)
+
+      # A rule in effect that compares a column holding a secret
+      # (PermissionForge::SecretColumns), stored before the model refused one.
+      SecretRuleFinding = Struct.new(:rule, :people_count, keyword_init: true) do
+        def resource = rule.resource
+        def permission_set = rule.resource.permission_set
+        def locked? = !EditableLock.locked_record(rule).nil?
+      end
+
+      def self.acknowledgement_supported? = PermissionForge::ResourceField.acknowledgement_supported?
+
+      # The threshold of "due for review", in days: config.admin_stale_assignment_days,
+      # or the default while it is nil. The one definition — Home's Stale
+      # card, the People page (pf_stale?), the audit's stale_assignments and
+      # StaleAssignmentAuditor all read it.
+      #
+      # @param configuration [Configuration]
+      # @return [Integer]
+      def self.stale_days(configuration = PermissionForge.configuration)
+        configuration.try(:admin_stale_assignment_days) || Configuration::AdminUiSettings::DEFAULT_STALE_ASSIGNMENT_DAYS
+      end
+
+      # The catalog only counts (`verify: false`): every admin page draws the
+      # navigation's count, so it reads the schema cache, never the database.
+      def initialize(configuration: PermissionForge.configuration, catalog: ModelCatalog.new(verify: false),
                      sensitive: SensitiveColumns.new(configuration: configuration))
         @configuration = configuration
         @catalog = catalog
         @sensitive = sensitive
       end
 
+      # Every list Home draws a card for (the navigation counts them all) =>
+      # the partial (home/_<partial>) that draws it, in Home's priority
+      # order: the one list Home renders from (#cards).
+      CARDS = { audit_findings: 'audit_card', broken_rules: 'broken_rules_card', privacy_findings: 'privacy_card',
+                unknown_mask_strategies: 'mask_strategies_card', broken_conditions: 'conditions_card',
+                secret_rules: 'secret_rules_card', unenforced_rules: 'rules_card', ending_soon: 'ending_card',
+                expired: 'expired_card', stale: 'stale_card', tidy: 'tidy_card' }.freeze
+
       def total
-        [audit_findings.size, privacy_findings.size, unenforced_rules.size, ending_soon.size, expired.size, stale.size,
-         tidy.size].sum
+        CARDS.each_key.sum { |card| public_send(card).size }
+      end
+
+      # The partials of the cards Home draws: those whose list has items.
+      #
+      # @return [Array<String>]
+      def cards
+        CARDS.filter_map { |list, partial| partial if public_send(list).any? }
       end
 
       def all_good?
@@ -83,12 +144,64 @@ module PermissionForge
       def unenforced_rules
         @unenforced_rules ||= begin
           enforced = rule_enforced_resources
-          counts = unenforced_rule_scope.where(resource_id: enforced.keys).group(:resource_id).count
+          counts = unenforced_rule_counts(enforced.keys)
           findings = counts.map { |id, count| RulesFinding.build(enforced.fetch(id), count, people_counts) }
           findings.sort_by { |finding| [finding.permission_set.name, finding.resource.name] }
         end
       end
 
+      # Rules in effect that name a column or an association that is not
+      # there — the audit's missing_rule_columns finding, the same rules.
+      def broken_rules
+        @broken_rules ||= rules_in_effect.filter_map do |rule|
+          problem = PermissionForge::Operators::RuleProblem.for(rule)
+          next unless problem
+
+          BrokenRuleFinding.new(rule: rule, problem: problem, people_count: people_counts.fetch(rule.resource.permission_set_id, 0))
+        end
+      end
+
+      # Rules in effect that compare a column holding a secret — the audit's
+      # secret_rule_columns finding, the same rules. They still apply.
+      def secret_rules
+        @secret_rules ||= begin
+          secrets = PermissionForge::SecretColumns.new(configuration: @configuration)
+          rules_in_effect.select { |rule| secrets.rule?(rule) }.map do |rule|
+            SecretRuleFinding.new(rule: rule, people_count: people_counts.fetch(rule.resource.permission_set_id, 0))
+          end
+        end
+      end
+
+      # --- Field rows and conditions the engine cannot read as written ----------
+
+      # Field rows in effect masked with a strategy this app does not know
+      # (ResourceField.with_unknown_mask_strategy, the audit's
+      # unknown_mask_strategies): masked fully until fixed.
+      def unknown_mask_strategies
+        @unknown_mask_strategies ||= PermissionForge::ResourceField.with_unknown_mask_strategy.map do |field|
+          MaskStrategyFinding.new(field: field, people_count: people_counts.fetch(field.resource.permission_set_id, 0))
+        end
+      end
+
+      # Sets whose activation conditions nobody can judge
+      # (PermissionSet.with_broken_conditions, the audit's incomplete_conditions).
+      def broken_conditions
+        @broken_conditions ||= PermissionForge::PermissionSet.with_broken_conditions.map do |set|
+          ConditionsFinding.new(permission_set: set, people_count: people_counts.fetch(set.id, 0))
+        end
+      end
+
+      # Active rules of the granting resources in effect: the rules that are
+      # applied right now (a muting set's rules never are). Not the ones View
+      # All skips — nobody is denied by those.
+      def rules_in_effect
+        @rules_in_effect ||= begin
+          enforced = granting_resources.reject(&:rules_bypassed?).map(&:id)
+          PermissionForge::PermissionSetRule.active.where(resource_id: enforced)
+                                            .includes(resource: :permission_set).order(:resource_id, :id).to_a
+        end
+      end
+
       def auto_query_scoping?
         @configuration.auto_query_scoping_enabled?
       end
@@ -96,8 +209,7 @@ module PermissionForge
       # --- Assignments --------------------------------------------------------
 
       def ending_soon
-        @ending_soon ||= assignments.where(expires_at: Time.current..ENDING_DAYS.days.from_now.end_of_day)
-                                    .order(:expires_at).to_a
+        @ending_soon ||= assignments.ending_within.order(:expires_at).to_a
       end
 
       def expired
@@ -110,7 +222,7 @@ module PermissionForge
       end
 
       def stale_days
-        @configuration.admin_stale_assignment_days || 90
+        self.class.stale_days(@configuration)
       end
 
       # --- Permission Sets to tidy up -----------------------------------------
@@ -129,42 +241,51 @@ module PermissionForge
         PermissionForge::PermissionSetUser.includes(:permission_set, :user)
       end
 
-      # Resources whose rules are in force (View All / Modify All skip them), by id.
+      # Readable Resources whose rules are in force (View All / Modify All
+      # skip them), by id. A Resource named after no model this app can load
+      # (`Custmer`) has no query to scope: the audit's integrity/unknown_models names it.
       def rule_enforced_resources
-        granting_resources.reject(&:rules_bypassed?).index_by(&:id)
+        readable_resources.reject { |resource| resource.rules_bypassed? || @catalog.find(resource.name).nil? }
+                          .index_by(&:id)
       end
 
-      def unenforced_rule_scope
-        rules = PermissionForge::PermissionSetRule.active
-        auto_query_scoping? ? rules.join_type_rules : rules
+      # Active rules the app's query scoping does not apply, counted per
+      # resource: every one while auto_query_scoping is off, the join rules
+      # (PermissionSetRule#join_rule?, the one definition) when it is on.
+      def unenforced_rule_counts(resource_ids)
+        rows = PermissionForge::PermissionSetRule.active.where(resource_id: resource_ids)
+        rows = rows.join_type_rules if auto_query_scoping?
+        rows.pluck(:resource_id, :join_type)
+            .select { |_, join_type| !auto_query_scoping? || !PermissionForge::PermissionSetRule.filter_join_type?(join_type) }
+            .group_by(&:first).transform_values(&:size)
       end
 
       def people_counts
         @people_counts ||= PermissionForge::PermissionSetUser.active_assignments.group(:permission_set_id).count
       end
 
+      # The granting Resource rows that count right now (Resource.in_effect,
+      # the one definition), with their sets and fields loaded.
       def granting_resources
-        @granting_resources ||= PermissionForge::Resource.active.where(read_access: true)
-                                                         .where(permission_set_id: PermissionForge::PermissionSet.active.granting.select(:id))
+        @granting_resources ||= PermissionForge::Resource.in_effect.merge(PermissionForge::PermissionSet.granting)
                                                          .includes(:permission_set, :resource_fields).to_a
       end
 
+      # Those of them people can read: where an unmasked sensitive field shows.
+      def readable_resources
+        @readable_resources ||= granting_resources.select(&:read_access)
+      end
+
+      # Readable and unmasked, and not acknowledged as intentional
+      # (ResourceField#exposes_unacknowledged?).
       def unmasked_sensitive_fields
-        acknowledged = self.class.acknowledgement_supported?
-        granting_resources.flat_map do |resource|
+        readable_resources.flat_map do |resource|
           resource.resource_fields.filter_map do |field|
-            sensitive_finding(resource, field.name, field: field) if exposed?(field, acknowledged)
+            sensitive_finding(resource, field.name, field: field) if field.exposes_unacknowledged?
           end
         end
       end
 
-      # Readable and unmasked, and not acknowledged as intentional.
-      def exposed?(field, acknowledged)
-        return false unless field.is_active && field.read_access && !field.mask_access
-
-        !(acknowledged && field.sensitive_acknowledged_at.present?)
-      end
-
       # Sensitive columns and virtual fields with no active field row are a
       # leak when they are readable unmasked anyway: the unconfigured-field
       # strategy lets them through, or the model declares them as extra fields
@@ -175,7 +296,7 @@ module PermissionForge
         passes = %w[pass_through warn].include?(@configuration.unconfigured_field_strategy.to_s)
         return [] unless passes || @configuration.grant_extra_fields_by_default?
 
-        granting_resources.flat_map { |resource| unconfigured_findings(resource, passes) }
+        readable_resources.flat_map { |resource| unconfigured_findings(resource, passes) }
       end
 
       # `passes` — whether unconfigured_field_strategy lets a field with no row through.

data/lib/permission_forge/admin/audit_log.rb

@@ -37,9 +37,7 @@ module PermissionForge
       # log can be read while recording is switched off; without the table
       # there is nothing to read and every list is empty.
       def self.table?
-        PermissionForge::AuditEvent.table_exists?
-      rescue StandardError
-        false
+        PermissionForge::DatabaseReach.table_exists?(PermissionForge::AuditEvent)
       end
 
       # Why the log is not recording, or nil when it records:
@@ -134,12 +132,11 @@ module PermissionForge
         Page.new(events: events, total: total, number: current, per_page: per_page)
       end
 
-      # 1 for anything that is not a number; at most the last page.
+      # 1 for anything that is not a whole number from 1 (ParamShapes.integer,
+      # the one reader); at most the last page.
       def self.page_number(number, total, per_page)
-        return 1 unless number.to_s.match?(/\A\d{1,9}\z/)
-
         last = [(total + per_page - 1) / per_page, 1].max
-        number.to_i.clamp(1, [last, MAX_PAGE].min)
+        ParamShapes.integer(number, default: 1, range: 1..).clamp(1, [last, MAX_PAGE].min)
       end
 
       # People the log names lately (KNOWN_PEOPLE_WINDOW), for the actor and

data/lib/permission_forge/admin/audit_trail.rb

@@ -2,13 +2,14 @@
 
 module PermissionForge
   module Admin
-    # Who created and who last edited each permission record. Creation comes
-    # from created_by / created_at (HasAuditTrail); the last edit from the
-    # record's latest change event when the audit log has one (LastChanges),
-    # else from updated_by / updated_at — an event names the real editor,
-    # while updated_by keeps the previous one across an edit by nobody, an
-    # HTTP Basic login or an API client. The full history is the audit log
-    # (Admin::AuditLog).
+    # Who created and who last edited each permission record. The creator is
+    # the actor of the record's creation event when the audit log has one
+    # (LastChanges.creations), else created_by; the last edit is the record's
+    # latest change event when the log has one (LastChanges), else
+    # updated_by / updated_at. An event names who really acted, while the
+    # columns stamp nobody for an HTTP Basic login or an API client (and
+    # updated_by keeps the previous editor). The full history is the audit
+    # log (Admin::AuditLog).
     class AuditTrail
       TYPES = {
         'permission_set' => 'PermissionForge::PermissionSet',
@@ -22,11 +23,13 @@ module PermissionForge
       }.freeze
 
       DAY_FILTERS = [7, 30, 90].freeze
-      CSV_HEADER = ['Type', 'Record', 'Where', 'Created by', 'Created at', 'Last edited by', 'Last edited at'].freeze
+      # The CSV's columns, named by permission_forge.ui.audit.csv.<column>.
+      CSV_COLUMNS = %w[type record where created_by created_at edited_by edited_at].freeze
 
       # `last_event` — the record's latest change event, or nil (no events:
       # auditing off, or the record predates the audit log).
-      Entry = Struct.new(:type, :record, :last_event, keyword_init: true) do
+      # `creation_event` — the record's creation event, or nil (likewise).
+      Entry = Struct.new(:type, :record, :last_event, :creation_event, keyword_init: true) do
         def created_by = record.try(:created_by)
         def updated_by = record.try(:updated_by)
         def created_at = record.created_at
@@ -42,6 +45,13 @@ module PermissionForge
 
           last_event.actor_id if last_event.actor_type == 'user'
         end
+
+        # The creator's user id as a String, or nil (not a person, or unknown).
+        def creator_id
+          return created_by_id&.to_s unless creation_event
+
+          creation_event.actor_id if creation_event.actor_type == 'user'
+        end
       end
 
       def self.type_of(record)
@@ -73,7 +83,7 @@ module PermissionForge
 
       # Every record belonging to a Permission Set (the set, its resources,
       # fields, actions, rules and assignments), filtered and sorted.
-      # Filters (all optional): who:, type:, days:, sort: ('asc' / 'desc', default 'desc').
+      # Filters (all optional): who:, type:, days: (an Integer of DAY_FILTERS), sort: ('asc' / 'desc', default 'desc').
       # @return [Array<Entry>]
       def for_permission_set(permission_set, **filters)
         entries = apply_filters(permission_set_entries(permission_set), filters)
@@ -84,7 +94,8 @@ module PermissionForge
       # @param describe [#call] (entry) -> [type_label, record_label, where]
       # @param person [#call] (entry) -> [created by, last edited by]
       def to_csv(entries, describe:, person:)
-        Csv.document([CSV_HEADER] + entries.map { |entry| csv_row(entry, describe, person) })
+        header = CSV_COLUMNS.map { |column| I18n.t("permission_forge.ui.audit.csv.#{column}") }
+        Csv.document([header] + entries.map { |entry| csv_row(entry, describe, person) })
       end
 
       private
@@ -109,14 +120,14 @@ module PermissionForge
 
       # Created it, or made its last edit (by the event when there is one).
       def made_by?(entry, user_id)
-        entry.created_by_id.to_s == user_id.to_s || entry.editor_id == user_id.to_s
+        entry.creator_id == user_id.to_s || entry.editor_id == user_id.to_s
       end
 
       def apply_filters(entries, filters)
         type, who, days = filters.values_at(:type, :who, :days)
         entries = entries.select { |e| e.type == type } if type.present? && TYPES.key?(type)
         entries = filter_who(entries, who) if who.present?
-        entries = filter_days(entries, days.to_i) if DAY_FILTERS.include?(days.to_i)
+        entries = filter_days(entries, days) if DAY_FILTERS.include?(days)
         entries
       end
 
@@ -147,14 +158,19 @@ module PermissionForge
         with_people(scope).map { |record| [type, record] }
       end
 
-      # [[type, record], ...] → entries, each with its latest change event.
+      # [[type, record], ...] → entries, each with its latest change event
+      # and its creation event.
       def entries_for(typed_records)
-        last = LastChanges.new(typed_records.map(&:last))
-        typed_records.map { |type, record| Entry.new(type: type, record: record, last_event: last.last_edit(record)) }
+        records = typed_records.map(&:last)
+        last = LastChanges.new(records)
+        created = LastChanges.creations(records)
+        typed_records.map do |type, record|
+          Entry.new(type: type, record: record, last_event: last.last_edit(record), creation_event: created[record])
+        end
       end
 
       def filter_who(entries, who)
-        entries.select { |e| e.created_by_id.to_s == who.to_s || e.editor_id == who.to_s }
+        entries.select { |e| e.creator_id == who.to_s || e.editor_id == who.to_s }
       end
 
       def filter_days(entries, days)

data/lib/permission_forge/admin/bulk_people_matcher.rb

@@ -4,7 +4,10 @@ module PermissionForge
   module Admin
     # Resolves pasted emails/names (one per line or comma-separated) to people
     # for bulk assignment. Exact, case-insensitive matches only — a near miss
-    # is reported as "not found" rather than guessed. Only people within
+    # is reported as "not found" rather than guessed. A column the user model
+    # encrypts (PermissionForge::EncryptedAttributes) holds ciphertext: a
+    # deterministically encrypted one matches the pasted value exactly
+    # (`where(email: value)` encrypts it), any other is not matched. Only people within
     # config.user_list_resolver match (PeopleDirectory#find_all): anyone else
     # is "not found" too.
     class BulkPeopleMatcher
@@ -60,14 +63,28 @@ module PermissionForge
       end
 
       def lookup(token)
-        needle = token.downcase
-        return exact(column_if_present('email'), needle) if token.include?('@')
+        return exact(email_columns, token) if token.include?('@')
 
-        exact(name_column, needle) || first_last_match(needle)
+        exact(name_column, token) || first_last_match(token)
       end
 
-      def exact(column, needle)
-        column && first_listed(model.where(model.arel_table[column].lower.eq(needle)))
+      # The first listed person whose value in any of `columns` equals the token.
+      def exact(columns, token)
+        scopes = Array(columns).filter_map { |column| equal_to(column, token) }
+        first_listed(scopes.reduce(:or)) if scopes.any?
+      end
+
+      # The people whose `column` equals the token, whatever its case; for a
+      # deterministically encrypted column the value as pasted or lower-cased
+      # (the attribute type encrypts it); nil for a column SQL cannot compare
+      # (encrypted otherwise).
+      def equal_to(column, token)
+        if PermissionForge::EncryptedAttributes.encrypted?(model, column)
+          return unless PermissionForge::EncryptedAttributes.deterministic?(model, column)
+
+          return model.where(column => [token, token.downcase].uniq)
+        end
+        model.where(model.arel_table[column].lower.eq(token.downcase))
       end
 
       # The first match that config.user_list holds.
@@ -79,26 +96,27 @@ module PermissionForge
         @directory ||= PeopleDirectory.new(configuration: @configuration)
       end
 
-      def column_if_present(column)
-        column if model.column_names.include?(column)
+      # Every email column the user table has (`email`, `email_address`).
+      def email_columns
+        PermissionForge::SchemaRead.columns_among(model, PersonLabel::EMAIL_ATTRIBUTES.map(&:to_s))
       end
 
       # "Ana Krasniqi" against separate first/last name columns.
-      def first_last_match(needle)
-        first, last = needle.split(/\s+/, 2)
+      def first_last_match(token)
+        first, last = token.split(/\s+/, 2)
         pair = first_last_columns
         return nil unless pair && last
 
-        table = model.arel_table
-        first_listed(model.where(table[pair.first].lower.eq(first).and(table[pair.last].lower.eq(last))))
+        scopes = [equal_to(pair.first, first), equal_to(pair.last, last)]
+        first_listed(scopes.first.merge(scopes.last)) if scopes.all?
       end
 
       def first_last_columns
-        FIRST_LAST_COLUMNS.find { |cols| (cols - model.column_names).empty? }
+        FIRST_LAST_COLUMNS.find { |cols| PermissionForge::SchemaRead.columns_among(model, cols).size == cols.size }
       end
 
       def name_column
-        (%w[name full_name display_name] & model.column_names).first
+        PermissionForge::SchemaRead.columns_among(model, %w[name full_name display_name]).first
       end
 
       def picked(ids)

data/lib/permission_forge/admin/chain_entries.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Admin
+    # Whether a Permission Set holds more than one Resource of a
+    # single-table-inheritance chain (ResourceChain: a base and a subclass on
+    # its table) — then a row that names the set about one of them says which
+    # ("Sales rep · VipCustomer", LabelsHelper#pf_set_entry_name): the field
+    # drawer's "Across all Permission Sets" and a person's effective access
+    # showed two rows "Sales rep" with different levels and no way to tell
+    # them apart (field test round 7, B#35). Every Resource row of the set
+    # counts, turned off or not: it is about naming, not about access.
+    #
+    # @example
+    #   ChainEntries.several?(set, %w[VipCustomer Customer]) # => true when the set has both Resources
+    #
+    # @api private
+    module ChainEntries
+      # @param permission_set [PermissionSet]
+      # @param names [Array<String, Symbol>] the Resource names of the chain
+      # @return [Boolean]
+      def self.several?(permission_set, names)
+        names = names.map(&:to_s)
+        return false if names.size < 2
+
+        permission_set.resources.count { |resource| names.include?(resource.name) } > 1
+      end
+
+      # The Resource rows named by one of `names`, in the order of `names`
+      # (a chain: the model first, then its bases nearest first), so the row
+      # nearest the model comes first (EffectiveAccess: the Resource a muting
+      # set is named with, B#38).
+      #
+      # @param resources [Array<Resource>] one Permission Set's rows
+      # @param names [Array<String>]
+      # @return [Array<Resource>]
+      def self.in_chain_order(resources, names)
+        names.flat_map { |name| resources.select { |resource| resource.name == name } }
+      end
+    end
+  end
+end

data/lib/permission_forge/admin/change_set.rb

@@ -52,12 +52,16 @@ module PermissionForge
         end
       end
 
+      # A flag the request turned on that stays off because what it needs is
+      # off (`needs`: :read, or :view_all_and_edit for Modify All). Not a change.
+      Refusal = Struct.new(:resource, :attribute, :needs, keyword_init: true)
+
       class Invalid < StandardError
         attr_reader :record
 
         def initialize(record)
           @record = record
-          super(record.errors.full_messages.to_sentence)
+          super(ListSentence.call(ErrorSentence.all(record.errors)))
         end
       end
 
@@ -79,6 +83,13 @@ module PermissionForge
         changes.empty?
       end
 
+      # @return [Array<Refusal>] what the request asked for and the
+      #   dependencies kept off (Edit with Read off, ...)
+      def refused
+        changes
+        @context.refused
+      end
+
       # Saves every pending record, all or nothing, under one audit
       # correlation id. Its own savepoint (requires_new) rolls back the saves
       # before a failing one — and their audit events — also when the caller's

data/lib/permission_forge/admin/change_set_parts/base.rb

@@ -13,7 +13,7 @@ module PermissionForge
 
         private
 
-        delegate :permission_set, :params, :sensitive, :muting?, :section, :resources, :resource_of,
+        delegate :permission_set, :params, :sensitive, :muting?, :section, :resources, :resource_of, :refused,
                  to: :@context
 
         def change(**attrs)
@@ -43,10 +43,11 @@ module PermissionForge
           section('bulk')
         end
 
-        # Records flagged is_editable: false are managed by the system/API and
-        # are never changed from the admin UI (their disabled inputs still post).
+        # Locked records (is_editable: false on them or on what they belong
+        # to: EditableLock, the one definition) are managed by the system/API
+        # and never changed from the admin UI (their disabled inputs still post).
         def locked?(record)
-          record.respond_to?(:is_editable) && record.is_editable == false
+          EditableLock.locked?(record)
         end
 
         def truthy?(value)

data/lib/permission_forge/admin/change_set_parts/context.rb

@@ -8,7 +8,8 @@ module PermissionForge
       # same resource/field objects, so later parts see earlier parts' edits
       # (e.g. field levels see the resource's new Edit flag).
       class Context
-        attr_reader :permission_set, :params, :sensitive
+        # refused: the ChangeSet::Refusal list the parts add to.
+        attr_reader :permission_set, :params, :sensitive, :refused
 
         def initialize(permission_set:, params:, sensitive:, catalog: nil)
           @permission_set = permission_set
@@ -16,6 +17,7 @@ module PermissionForge
           @sensitive = sensitive
           @controller_catalog = catalog
           @muting = permission_set.is_muting
+          @refused = []
         end
 
         # The app's controller actions (see NewActions). Built on first use:

data/lib/permission_forge/admin/change_set_parts/field_edit.rb

@@ -9,8 +9,11 @@ module PermissionForge
       class FieldEdit
         ATTRS = %w[label description is_active].freeze
         MASK_LEVELS = %w[masked mask].freeze
+        # A blank label over a generated one is no change (Prefill.posted);
+        # over a label an admin wrote it is what the model stores for a blank
+        # label, the name (ResourceField#label_to_store: NormalizesLabel).
         CASTS = {
-          'label' => ->(value, field) { value.to_s.strip.presence || field.name.humanize },
+          'label' => ->(value, field) { field.label_to_store(Prefill.posted(field, :label, value).to_s.strip) },
           'is_active' => ->(value, _field) { Values.truthy?(value) }
         }.freeze
         TEXT_CAST = ->(value, _field) { value.to_s.strip.presence }

data/lib/permission_forge/admin/change_set_parts/field_levels.rb

@@ -37,7 +37,7 @@ module PermissionForge
           return [] unless resource
 
           fields = Array(bulk['keys']).filter_map { |key| resource.resource_fields.find { |field| field.name == key.to_s } }
-          fields.reject { |field| field.is_editable == false }
+          fields.reject { |field| locked?(field) }
         end
 
         def changes_for_field(field, attrs)

data/lib/permission_forge/admin/change_set_parts/new_actions.rb

@@ -80,7 +80,7 @@ module PermissionForge
         end
 
         def build_new_action(resource, key, permitted)
-          action = resource.resource_actions.build(name: key, label: key.humanize, is_active: true,
+          action = resource.resource_actions.build(name: key, label: key, is_active: true,
                                                    is_permitted: truthy?(permitted))
           change(kind: :new_action, record: action, attribute: 'is_permitted', from: nil, to: action.is_permitted,
                  resource: resource)